#!/usr/bin/env bash

set -Eeuo pipefail
umask 077

readonly TARGET_HOST=sqjcnginx02
readonly TARGET_IP=10.2.203.103
readonly RUNTIME_TARGET=/opt/zhct-deploy/common/lib/runtime.sh
readonly UNITS_TARGET=/opt/zhct-deploy/roles/nginx/manifests/systemd-units.tsv
readonly RUNTIME_SOURCE=/root/q102-runtime.sh
readonly UNITS_SOURCE=/root/q102-systemd-units.tsv
readonly OLD_RUNTIME_SHA256=89e5149c516af624dd56b3ef8aaa389a4f2447a68dfe989978c61c459d859162
readonly OLD_UNITS_SHA256=98bec522fafb6d91f6be7f2bffeb40353b5b07882a82982b67c400d05cc4bc34
readonly NEW_RUNTIME_SHA256=4c06e4ad325de7241607b06d93c99c2f35f3422bfcbdbeeb43b530f2053f4bb6
readonly NEW_UNITS_SHA256=24ce7c17d7a7cf8070d1cdd9013c54e49a445cd264a0ecafcae4ef1912811d61
readonly RUN_ID="q102-framework-refresh-$(date -u +%Y%m%dT%H%M%SZ)"
readonly BACKUP_DIR="/var/backups/zhct-q102/files/${RUN_ID}/framework-refresh"
readonly AUDIT_ROOT=/root/q102-manual-upload-audit
readonly AUDIT_LOG="${AUDIT_ROOT}/${RUN_ID}.log"

mkdir -p "$AUDIT_ROOT"
chmod 0700 "$AUDIT_ROOT"
exec > >(tee -a "$AUDIT_LOG") 2>&1

mutation_started=0
rollback_status=NOT_REQUIRED

finish() {
  rc=$?
  trap - EXIT
  if test "$rc" -ne 0 && test "$mutation_started" -eq 1; then
    rollback_status=ATTEMPTED
    if cp -a "$BACKUP_DIR/runtime.sh" "$RUNTIME_TARGET" &&
       cp -a "$BACKUP_DIR/systemd-units.tsv" "$UNITS_TARGET"; then
      rollback_status=PASS
    else
      rollback_status=FAIL
    fi
  fi
  printf 'Q102_FRAMEWORK_REFRESH_ROLLBACK=%s\n' "$rollback_status"
  printf 'Q102_FRAMEWORK_REFRESH_BACKUP=%s\n' "$BACKUP_DIR"
  printf 'Q102_FRAMEWORK_REFRESH_AUDIT_LOG=%s\n' "$AUDIT_LOG"
  printf 'Q102_FRAMEWORK_REFRESH_END RC=%s\n' "$rc"
  exit "$rc"
}
trap finish EXIT

printf 'Q102_FRAMEWORK_REFRESH_BEGIN\n'
printf 'Q102_RUN_ID=%s\n' "$RUN_ID"
printf 'Q102_TARGET_HOST=%s\n' "$TARGET_HOST"
printf 'Q102_TARGET_IP=%s\n' "$TARGET_IP"
date --iso-8601=seconds

test "$(id -u)" -eq 0
test "$(hostname -s)" = "$TARGET_HOST"
ip -o -4 addr show scope global
ip -o -4 addr show scope global |
  awk '{print $4}' |
  cut -d/ -f1 |
  grep -Fxq "$TARGET_IP"
printf 'Q102_FRAMEWORK_REFRESH_IDENTITY=PASS\n'

test -f "$RUNTIME_TARGET"
test -f "$UNITS_TARGET"
test -f "$RUNTIME_SOURCE"
test -f "$UNITS_SOURCE"

current_runtime_sha256=$(sha256sum "$RUNTIME_TARGET" | awk '{print $1}')
current_units_sha256=$(sha256sum "$UNITS_TARGET" | awk '{print $1}')
source_runtime_sha256=$(sha256sum "$RUNTIME_SOURCE" | awk '{print $1}')
source_units_sha256=$(sha256sum "$UNITS_SOURCE" | awk '{print $1}')

printf 'CURRENT_RUNTIME_SHA256=%s\n' "$current_runtime_sha256"
printf 'CURRENT_UNITS_SHA256=%s\n' "$current_units_sha256"
printf 'SOURCE_RUNTIME_SHA256=%s\n' "$source_runtime_sha256"
printf 'SOURCE_UNITS_SHA256=%s\n' "$source_units_sha256"

test "$current_runtime_sha256" = "$OLD_RUNTIME_SHA256"
test "$current_units_sha256" = "$OLD_UNITS_SHA256"
test "$source_runtime_sha256" = "$NEW_RUNTIME_SHA256"
test "$source_units_sha256" = "$NEW_UNITS_SHA256"
bash -n "$RUNTIME_SOURCE"
printf 'Q102_FRAMEWORK_REFRESH_HASH_GATE=PASS\n'

test ! -e "/var/backups/zhct-q102/files/${RUN_ID}"
install -d -m 0750 -o root -g root "$BACKUP_DIR"
cp -a "$RUNTIME_TARGET" "$BACKUP_DIR/runtime.sh"
cp -a "$UNITS_TARGET" "$BACKUP_DIR/systemd-units.tsv"
printf 'Q102_FRAMEWORK_REFRESH_BACKUP=PASS\n'

mutation_started=1
install -m 0644 -o root -g root "$RUNTIME_SOURCE" "$RUNTIME_TARGET"
install -m 0644 -o root -g root "$UNITS_SOURCE" "$UNITS_TARGET"

test "$(sha256sum "$RUNTIME_TARGET" | awk '{print $1}')" = "$NEW_RUNTIME_SHA256"
test "$(sha256sum "$UNITS_TARGET" | awk '{print $1}')" = "$NEW_UNITS_SHA256"
bash -n "$RUNTIME_TARGET"
stat -c 'REFRESHED=%n MODE=%a OWNER=%U:%G SIZE=%s' \
  "$RUNTIME_TARGET" "$UNITS_TARGET"

mutation_started=0
rollback_status=NOT_REQUIRED
printf 'Q102_FRAMEWORK_REFRESH_PASS\n'